Commit 83318d0c authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-xe-fixes-2026-03-26' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes 



- Fix UAF in SRIOV migration restore (Winiarski)
- Updates to HW W/a (Roper)
- VMBind remap fix (Auld)

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/acUgq2q2DrCUzFql@intel.com
parents aab01a88 bfe9e314

drivers/gpu/drm/xe/regs/xe_gt_regs.h

+1 −0
Original line number Diff line number Diff line
@@ -553,6 +553,7 @@ 
#define   ENABLE_SMP_LD_RENDER_SURFACE_CONTROL	REG_BIT(44 - 32)

#define   FORCE_SLM_FENCE_SCOPE_TO_TILE		REG_BIT(42 - 32)

#define   FORCE_UGM_FENCE_SCOPE_TO_TILE		REG_BIT(41 - 32)

#define   L3_128B_256B_WRT_DIS			REG_BIT(40 - 32)

#define   MAXREQS_PER_BANK			REG_GENMASK(39 - 32, 37 - 32)

#define   DISABLE_128B_EVICTION_COMMAND_UDW	REG_BIT(36 - 32)

drivers/gpu/drm/xe/xe_pt.c

+6 −6
Original line number Diff line number Diff line
@@ -1442,9 +1442,9 @@ static int op_check_svm_userptr(struct xe_vm *vm, struct xe_vma_op *op, 
		err = vma_check_userptr(vm, op->map.vma, pt_update);

		break;

	case DRM_GPUVA_OP_REMAP:

		if (op->remap.prev)

		if (op->remap.prev && !op->remap.skip_prev)

			err = vma_check_userptr(vm, op->remap.prev, pt_update);

		if (!err && op->remap.next)

		if (!err && op->remap.next && !op->remap.skip_next)

			err = vma_check_userptr(vm, op->remap.next, pt_update);

		break;

	case DRM_GPUVA_OP_UNMAP:
@@ -2198,12 +2198,12 @@ static int op_prepare(struct xe_vm *vm, 


		err = unbind_op_prepare(tile, pt_update_ops, old);



		if (!err && op->remap.prev) {

		if (!err && op->remap.prev && !op->remap.skip_prev) {

			err = bind_op_prepare(vm, tile, pt_update_ops,

					      op->remap.prev, false);

			pt_update_ops->wait_vm_bookkeep = true;

		}

		if (!err && op->remap.next) {

		if (!err && op->remap.next && !op->remap.skip_next) {

			err = bind_op_prepare(vm, tile, pt_update_ops,

					      op->remap.next, false);

			pt_update_ops->wait_vm_bookkeep = true;
@@ -2428,10 +2428,10 @@ static void op_commit(struct xe_vm *vm, 


		unbind_op_commit(vm, tile, pt_update_ops, old, fence, fence2);



		if (op->remap.prev)

		if (op->remap.prev && !op->remap.skip_prev)

			bind_op_commit(vm, tile, pt_update_ops, op->remap.prev,

				       fence, fence2, false);

		if (op->remap.next)

		if (op->remap.next && !op->remap.skip_next)

			bind_op_commit(vm, tile, pt_update_ops, op->remap.next,

				       fence, fence2, false);

		break;

drivers/gpu/drm/xe/xe_sriov_packet.c

+2 −0
Original line number Diff line number Diff line
@@ -341,6 +341,8 @@ ssize_t xe_sriov_packet_write_single(struct xe_device *xe, unsigned int vfid, 
		ret = xe_sriov_pf_migration_restore_produce(xe, vfid, *data);

		if (ret) {

			xe_sriov_packet_free(*data);

			*data = NULL;



			return ret;

		}

drivers/gpu/drm/xe/xe_vm.c

+18 −4
Original line number Diff line number Diff line
@@ -2554,7 +2554,6 @@ static int xe_vma_op_commit(struct xe_vm *vm, struct xe_vma_op *op) 
			if (!err && op->remap.skip_prev) {

				op->remap.prev->tile_present =

					tile_present;

				op->remap.prev = NULL;

			}

		}

		if (op->remap.next) {
@@ -2564,11 +2563,13 @@ static int xe_vma_op_commit(struct xe_vm *vm, struct xe_vma_op *op) 
			if (!err && op->remap.skip_next) {

				op->remap.next->tile_present =

					tile_present;

				op->remap.next = NULL;

			}

		}



		/* Adjust for partial unbind after removing VMA from VM */

		/*

		 * Adjust for partial unbind after removing VMA from VM. In case

		 * of unwind we might need to undo this later.

		 */

		if (!err) {

			op->base.remap.unmap->va->va.addr = op->remap.start;

			op->base.remap.unmap->va->va.range = op->remap.range;
@@ -2687,6 +2688,8 @@ static int vm_bind_ioctl_ops_parse(struct xe_vm *vm, struct drm_gpuva_ops *ops, 


			op->remap.start = xe_vma_start(old);

			op->remap.range = xe_vma_size(old);

			op->remap.old_start = op->remap.start;

			op->remap.old_range = op->remap.range;



			flags |= op->base.remap.unmap->va->flags & XE_VMA_CREATE_MASK;

			if (op->base.remap.prev) {
@@ -2835,9 +2838,20 @@ static void xe_vma_op_unwind(struct xe_vm *vm, struct xe_vma_op *op, 
			xe_svm_notifier_lock(vm);

			vma->gpuva.flags &= ~XE_VMA_DESTROYED;

			xe_svm_notifier_unlock(vm);

			if (post_commit)

			if (post_commit) {

				/*

				 * Restore the old va range, in case of the

				 * prev/next skip optimisation. Otherwise what

				 * we re-insert here could be smaller than the

				 * original range.

				 */

				op->base.remap.unmap->va->va.addr =

					op->remap.old_start;

				op->base.remap.unmap->va->va.range =

					op->remap.old_range;

				xe_vm_insert_vma(vm, vma);

			}

		}

		break;

	}

	case DRM_GPUVA_OP_PREFETCH:

drivers/gpu/drm/xe/xe_vm_types.h

+4 −0
Original line number Diff line number Diff line
@@ -373,6 +373,10 @@ struct xe_vma_op_remap { 
	u64 start;

	/** @range: range of the VMA unmap */

	u64 range;

	/** @old_start: Original start of the VMA we unmap */

	u64 old_start;

	/** @old_range: Original range of the VMA we unmap */

	u64 old_range;

	/** @skip_prev: skip prev rebind */

	bool skip_prev;

	/** @skip_next: skip next rebind */